Strong Password Generator
A secure random password built from your browser's cryptographic random source, with the entropy printed underneath so you can see how strong it really is.
Words are drawn from the 7,776-word EFF list, so each one adds 12.9 bits. Easier to type and remember than a random string of the same strength.
A PIN is only as safe as the device that rate-limits it. Do not reuse it as a password.
Generate a Strong, Secure, Random Password
A password you invent yourself carries your habits: a name, a year, a capital at the front, a symbol at the end. Cracking tools know those habits and try them first. This page opens the Password Generator at 20 characters with symbols enabled, which is the setting most people are looking for when they search for a strong password generator, and generates one before you touch anything.
Under the result you get two readings: a strength label and the entropy in bits. The label is a coarse scale, useful at a glance; the number is the real measure, and it is what the rest of this page is about.
Strength is length and randomness, not shape
A password does not become strong by looking complicated. P@ssw0rd! has a capital, a digit, two symbols and a substitution, and it is one of the first strings any cracking dictionary tries. What counts is how many equally likely possibilities the attacker has to work through, and that depends on two things only: how many characters the password has, and how unpredictable each one is. Because both go into the same product, an extra character multiplies the work, while an extra character class only widens it a little.
The entropy behind each setting
Entropy in bits is the length multiplied by the base-2 logarithm of the pool size, and every bit doubles the attacker's work. Uppercase, lowercase and numbers give a pool of 62. The Symbols box adds 26 punctuation marks, for a pool of 88 characters.
| What you generate | Pool | Entropy |
|---|---|---|
| 8 characters, all four sets | 88 | about 52 bits |
| 16 characters, letters and digits | 62 | about 95 bits |
| 16 characters, all four sets | 88 | about 103 bits |
| 20 characters, letters and digits | 62 | about 119 bits |
| 20 characters, all four sets, as this page opens | 88 | about 129 bits |
Entropy tables published elsewhere usually assume all 94 printable <abbr title="American Standard Code for Information Interchange">ASCII characters; this generator uses 26 of the 32 punctuation marks, so its largest pool is 88 rather than 94 and its numbers land a shade lower. Either way, 129 bits is far beyond anything an offline attack can grind through, which is why the strength label reads at its top level here.
Ambiguous characters and guaranteed sets
Two of the checkboxes change the shape of the result rather than its length. Exclude ambiguous removes 0, O, l, 1 and I, the characters people misread when a password is printed on a card or read out over the phone; the pool for letters and digits shrinks from 62 to 57, which costs roughly half a bit per character. At least one of each guarantees a character from every set you ticked, so a form that demands a digit accepts the first password you generate instead of the third.
If the password will be typed by a human rather than pasted by a password manager, the Wi-Fi password page opens the same generator with both of those decisions already made.
Nothing leaves the page
The password is assembled in your browser with crypto.getRandomValues and shuffled with the same random source, so there is no server to trust, no log to leak and no history to clear. The Share link control under the tool copies the length and the character-set boxes so a colleague can open the generator set up the same way; the generated value itself is never put in the link. Paste the result into a password manager, use a different password for every account, and turn on two-factor authentication — the reasoning behind all three is in the guide to strong passwords.
When a random string is the wrong shape
For the two or three secrets you have to type from memory, a passphrase of five or six random words reaches the same strength in a form you can actually recall. For a lock screen or a keypad that only accepts digits, use the PIN generator and read what it says about how little a PIN is worth on its own.